New AI agents, customizable workflows and MCP connectivity aim to reduce manual investigation and accelerate firewall policy decisions while keeping human approval at the centre.
FireMon has introduced FireMon Agentic AI, bringing autonomous assistance into network security policy management to help enterprises investigate access requirements, evaluate policy options and prepare security changes across complex IT environments.
Built into FireMon’s network security management solutions, the platform positions AI agents alongside security practitioners, enabling them to handle multi-step operational tasks using existing policy data, tools and contextual intelligence. Customers can use FireMon’s pre-built agents, customize them, create their own or connect external AI workflows through its Model Context Protocol (MCP) Server.
The announcement addresses a persistent challenge for network security teams: managing access policies across multiple firewall vendors, cloud environments and network segmentation technologies. A single business access request can involve several devices and policies, often with multiple technically valid implementation options. Investigating those options, gathering evidence and preparing coordinated changes can consume significant engineering time.
FireMon’s approach is to delegate investigation and preparation to AI agents while leaving decisions requiring organizational judgment with human practitioners.
“AI can accelerate network security operations, but the authority to make consequential access decisions must remain with practitioners.” — Jody Brazil, Founder and CEO, FireMon
“Network security has never been more complex, and the answer isn’t more infrastructure. It’s putting the policy context FireMon has built over 25 years to work,” said Jody Brazil, Founder and CEO of FireMon. He said customers could deploy FireMon’s agents, build their own and connect the platform to broader agentic workflows while retaining human oversight.
The initial platform includes three key agents. The FireMon Intelligent Agent searches and analyses policy data, generates and executes Security Intelligence Query Language queries, and explains the findings in response to practitioner questions. The Network Designer Agent translates business access requirements into firewall policy recommendations. The Policy Change Designer Agent takes the process further by coordinating discovery, recommendations and preparation of Policy Plan changes across devices and policies.
Importantly, the system does not automatically deploy proposed changes to firewalls. Practitioners review and accept the recommendations before they are saved into the workflow. Agents can also pause when a decision requires human input, such as choosing between multiple valid policy alternatives.
The FireMon MCP Server extends these capabilities to external AI applications. It allows authorized agents to retrieve selected policy information, investigate incidents using network policy evidence and prepare staged Policy Plan changes. Access is governed through roles and credentials.
Customers can configure agent instructions, assign tools and permissions, select supported large language models, including approved model environments, and restrict operations to designated device groups. AI enablement is optional and off by default, with access controls and audit trails supporting accountability.
The move reflects a broader shift in enterprise security operations: from using AI primarily to surface information towards employing agents to execute defined operational workflows. However, the effectiveness of such systems will depend on the quality of policy data, the boundaries assigned to agents and the strength of human approval mechanisms.
FireMon Agentic AI and the MCP Server are scheduled to become available in November 2026, initially at no additional FireMon charge.